Securing Web Services with WS-Security

Chapter 6. Portable Identity, Authentication, and Authorization

Web services increasingly cross organizational boundaries. Yet previously there was no standard way to convey security attributes about individuals from one organization to another. How subjects (individuals or entities) are identified, how their digital credentials are created and maintained, and how permissions for access to resources are specified were not standardized, so sharing identity or security attributes outside one organization was extremely difficult. Increasingly, as inter-organizational integrations become commonplace, the need for federation of security attributes becomes more and more important. It is this desire to establish identity in one organization with one ...